Edge Delta MCP Server Tools Reference
8 minute read
AI agents discover these tools automatically when they connect to the Edge Delta MCP server. This page exists for humans: use it to write more directed prompts, understand what an agent can and cannot do, and decide which token permissions to grant.
Each tool is marked Read-only or Write. Read-only tools never change anything in your organization. Write tools create new pipeline versions or deploy them to your fleet.
A typical investigation flows from schema discovery through queries to action:
graph LR A[AI agent] --> B[discover_schema
build_cql] B --> C[Search and graph tools] C --> D[Pipeline tools] D --> E[validate, save,
deploy]
Tool summary
The 28 tools fall into nine categories:
| Category | Tools |
|---|---|
| Schema discovery and query building | discover_schema, search_metrics, validate_cql, build_cql |
| Search | get_log_search, get_metric_search, get_event_search, get_log_patterns, get_trace_timeline |
| Graphs | get_log_graph, get_metric_graph, get_trace_graph, get_pattern_graph |
| Facets | facets, facet_options |
| Pipeline management | get_pipelines, get_pipeline_config, get_pipeline_history, validate_pipeline_config, save_pipeline_config, deploy_pipeline, revert_pipeline, add_pipeline_source |
| Live capture | start_pipeline_capture, get_pipeline_capture_status, get_pipeline_capture_results, get_pipeline_capture_task |
| Processor dry runs | test_pipeline_ottl, test_pipeline_node |
| Ingestion | get_ingestion_endpoint |
| Dashboards | get_all_dashboards, get_dashboard |
Time-based tools share the same conventions as the rest of the platform: lookback takes Go durations (default 1h), from and to take ISO 8601 timestamps, and queries use Common Query Language (CQL).
Schema discovery and query building
Agents typically call these tools first to learn your organization’s fields and construct valid queries.
discover_schema
Read-only. Returns the available schema for a scope: all filterable field names, sample values for common fields, a CQL syntax reference, and sample queries. Agents call this before constructing searches.
Parameters: scope (required: log, metric, trace, pattern, or event), include_sample_values (default true).
Example prompts:
- “What fields can I filter logs by?”
- “Which services are reporting data right now?”
search_metrics
Read-only. Fuzzy search for metric names by keyword, ranked by relevance. Useful before get_metric_search or get_metric_graph, which both need exact names.
Parameters: pattern (required, case-insensitive keywords), limit (default 20, max 100).
Example prompts:
- “Do we have any metrics about CPU usage?”
- “Find metrics related to Kafka consumer lag.”
validate_cql
Read-only. Validates a CQL query before executing it, catching regex usage, invalid operators, and unknown fields. Returns errors, warnings, suggestions, and a normalized query.
Parameters: query (required), scope (required).
build_cql
Read-only. Constructs a valid CQL query from structured filters (equality, OR lists, negation, numeric comparisons, wildcards) and validates field names against known facets.
Parameters: scope (required), filters (required JSON object), check_values (default true).
Search tools
These tools query your telemetry data directly.
get_log_search
Read-only. Searches logs with CQL. Full-text search is supported; regex is not. Common fields: service.name, severity_text, host.name, ed.tag.
Parameters: query, lookback (default 1h), from, to, limit (default 20, max 1000), cursor, order.
Example prompts:
- “Show me error logs from the checkout service in the last 4 hours.”
- “Search logs for ‘connection refused’ across all services.”
get_metric_search
Read-only. Searches and aggregates a metric as a time series or table. The metric name must be exact.
Parameters: metric_name (required), aggregation_method (required: sum, avg, min, max, count, median), filter_query, group_by_keys, rollup_period, plus the shared time and paging parameters and graph_type (timeseries or table).
Example prompts:
- “What is the average request latency per service over the last day?”
- “Sum the bytes processed metric grouped by pipeline.”
get_event_search
Read-only. Searches events such as pattern anomalies, monitor alerts, and Kubernetes events. Common queries include event.type:"pattern_anomaly" and event.domain:"K8s".
Parameters: query, plus the shared time and paging parameters.
Example prompts:
- “Which monitors triggered in the last 24 hours?”
- “Show Kubernetes events for the payments namespace today.”
get_log_patterns
Read-only. Returns top log patterns (clustered message signatures) with counts, proportions, sentiment, and change over time. The summary mode returns roughly 50 interesting clusters; negative filters to negative-sentiment patterns.
Parameters: query, summary, negative, offset (comparison durations), plus the shared time and paging parameters.
Example prompts:
- “What new error patterns appeared in the last hour?”
- “Summarize the most anomalous log patterns since this morning.”
get_trace_timeline
Read-only. Fetches OpenTelemetry spans for a timeline view. Requires field-based CQL (no full-text). include_child_spans pulls full trace context.
Parameters: query, include_child_spans, plus the shared time and paging parameters.
Example prompts:
- “Show me failed spans from the api service in the last hour.”
- “Get the full trace for the slowest checkout request.”
Graph tools
Graph tools return time series data suitable for spotting trends and spikes.
get_log_graph
Read-only. Time series of log counts matching a CQL filter.
Example prompt: “Graph error log volume for the last 6 hours.”
get_metric_graph
Read-only. Time series for a metric (exact name), with the same aggregation, filter, and grouping parameters as get_metric_search.
Example prompt: “Plot p95 memory usage by host for the last day.”
get_trace_graph
Read-only. Time series from traces: request counts, or latency percentiles (P50 and P95) when data_type is latency.
Example prompt: “How has checkout latency trended over the past 12 hours?”
get_pattern_graph
Read-only. Time series of log pattern counts with volatility filtering (all, new, existing, gone) to isolate patterns that appeared or disappeared.
Example prompt: “Which log patterns are new today compared to yesterday?”
Facet tools
Lower-level alternatives to discover_schema for field discovery.
facets
Read-only. Lists all available field names for a scope (names only, no values).
facet_options
Read-only. Lists observed values for a specific field in a scope, for example every value of service.name. Useful for verifying a value exists before querying.
Example prompt: “List all service names we collect logs from.”
Pipeline management tools
These tools inspect and change pipeline configurations. Saving creates a new version without affecting the fleet; only deploy_pipeline changes what agents run.
get_pipelines
Read-only. Lists pipelines and returns the conf_id values that all other pipeline tools require. Filter by tag with keyword.
Example prompt: “List all my pipelines and their fleet types.”
get_pipeline_config
Read-only. Returns the full configuration content and metadata for one pipeline.
Example prompt: “Show me the current config of the production Kubernetes pipeline.”
get_pipeline_history
Read-only. Returns the version history for a pipeline. Each entry’s timestamp is the version identifier used by deploy_pipeline and revert_pipeline.
Example prompt: “Who changed the gateway pipeline last week?”
validate_pipeline_config
Read-only. Validates a complete pipeline YAML without saving or deploying. Returns whether the config is valid and the reason if not.
Example prompt: “Check if this pipeline config is valid before saving it.”
save_pipeline_config
Write. Saves a complete YAML as a new pipeline version. The fleet is unchanged until a deploy.
Parameters: conf_id (required), content (required, full YAML), description.
Example prompt: “Add a mask processor for email addresses and save it as a new version, but don’t deploy.”
deploy_pipeline
Write. Deploys a saved version to the fleet. This changes what your agents run, so grant deploy-capable tokens deliberately. The version is a history timestamp from get_pipeline_history.
Example prompt: “Deploy the version I just saved to the staging fleet.”
revert_pipeline
Write. Copies a prior version’s content into a new version. The fleet is unchanged until you deploy the new version.
Example prompt: “Roll the pipeline config back to the version from before today’s incident.”
add_pipeline_source
Write. Adds a data source node (such as file_input, kubernetes_input, or demo_input) and saves the config as a new version without deploying.
Example prompt: “Add a file input for /var/log/nginx/access.log to the web pipeline.”
Live capture tools
Live capture samples real data flowing through pipeline nodes on running agents. Tasks are ephemeral and self-expiring, and they never modify the pipeline. See Live Capture for the concept.
start_pipeline_capture
Read-only. Starts a capture task and returns its task ID.
Parameters: conf_id (required), duration_seconds (default 120), nodes (omit for all nodes), max_items (default 20, max 100), polling_interval.
Example prompt: “Capture what the mask_pii node is doing to real data for two minutes.”
get_pipeline_capture_status
Read-only. Per-agent status of a capture task. Agents poll until a capture reports success.
get_pipeline_capture_results
Read-only. Returns captured samples showing data before and after each node.
Example prompt: “Show me what the data looked like before and after the parsing node.”
get_pipeline_capture_task
Read-only. Returns the currently active capture task for a pipeline, if any.
Processor dry-run tools
Dry runs test processing logic against sample data without saving or deploying anything.
test_pipeline_ottl
Read-only. Runs OTTL statements against sample OTLP log items and returns the transformed items.
Example prompt: “Test this OTTL statement against these three sample logs before we add it to the pipeline.”
test_pipeline_node
Read-only. Runs a complete processor node of any type (log_to_metric, parse_json_attributes, grok, mask, and others) against sample items and returns each output path’s emitted items.
Example prompt: “Dry-run this log_to_metric node against sample data and show me the metrics it would emit.”
Ingestion tool
get_ingestion_endpoint
Read-only. Returns the HTTPS ingestion endpoints for every ingestion pipeline in the organization, with stream tokens, sample payloads, and ready-to-run test commands for logs, metrics, traces, and events.
Example prompt: “How do I send test logs into Edge Delta from this script?”
Dashboard tools
get_all_dashboards
Read-only. Lists all dashboards in the organization. Set include_definitions to include full widget definitions.
Example prompt: “What dashboards do we have for the payments team?”
get_dashboard
Read-only. Returns a dashboard’s full configuration, including widget definitions and layout.
Example prompt: “What queries power the SRE overview dashboard?”
MCP resources
Besides tools, the server exposes MCP resources that clients can read directly: services://list (service names in your organization), facets://{scope} and facet_options://{scope}/{facet} (field discovery), and per-scope facet-keys:// references for logs, metrics, traces, patterns, and events.
See Also
- Edge Delta MCP Server - Setup, client configuration, and verification.
- Common Query Language (CQL) - Query syntax used by the search tools.
- Live Capture - How capture sampling works.
- API Reference - The REST API these tools call.